wehub-resource-sync
41 lines
1.5 KiB
YAML
41 lines
1.5 KiB
YAML
# Strategic-merge patch adding the blast-radius selectors that controller-gen
|
|
# cannot express. Webhooks are merged by their `name`, so each entry only patches
|
|
# the matching webhook (mcacheblendpod.lmcache.ai = CacheBlend, mlmcachepod.lmcache.ai =
|
|
# LMCache). Each injector has its own opt-in label so the two never cross-fire.
|
|
#
|
|
# - objectSelector: only mutate pods carrying the injector's opt-in label
|
|
# (lmcache.ai/cacheblend-inject / lmcache.ai/lmcache-inject = "true"); keeps the
|
|
# cluster-wide CREATE-pods rule from touching unrelated workloads.
|
|
# - namespaceSelector: never mutate pods in kube-system / kube-public / the operator
|
|
# namespace (which runs under the "restricted" PSS profile and would reject the
|
|
# injected hostIPC), per design §10.
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: MutatingWebhookConfiguration
|
|
metadata:
|
|
name: mutating-webhook-configuration
|
|
webhooks:
|
|
- name: mcacheblendpod.lmcache.ai
|
|
objectSelector:
|
|
matchLabels:
|
|
lmcache.ai/cacheblend-inject: "true"
|
|
namespaceSelector:
|
|
matchExpressions:
|
|
- key: kubernetes.io/metadata.name
|
|
operator: NotIn
|
|
values:
|
|
- kube-system
|
|
- kube-public
|
|
- lmcache-operator-system
|
|
- name: mlmcachepod.lmcache.ai
|
|
objectSelector:
|
|
matchLabels:
|
|
lmcache.ai/lmcache-inject: "true"
|
|
namespaceSelector:
|
|
matchExpressions:
|
|
- key: kubernetes.io/metadata.name
|
|
operator: NotIn
|
|
values:
|
|
- kube-system
|
|
- kube-public
|
|
- lmcache-operator-system
|